Colony Firewall Control is beta software. It runs a daemon as root with CAP_NET_ADMIN and makes allow/deny decisions about your network traffic, so security reports are taken seriously -- but expectations should match the project's maturity: there has been no external security audit yet, and interfaces may change without notice.

The explicit application confinement mode (cfc applications run, new in 0.7.0) is experimental, and its interface and platform requirements may change.

Only the latest release and the current main branch receive security fixes. Older releases are not supported; upgrade before reporting.

Please report vulnerabilities privately via GitHub's security advisory form for this repository:

• Go to the repository's Security tab -> Report a vulnerability, or use https://github.com/Project-Colony/Colony-Firewall-Control/security/advisories/new

Please do not open a public issue for anything you believe is exploitable (privilege escalation via the daemon, rule-bypass of the NFQUEUE filter, crafted-packet parsing crashes, socket permission problems, a non-root program other than the installed app and tray getting a firewall change accepted, etc.).

Out of scope: the limits documented in What this firewall does not protect against, such as root processes, established or inherited flows, replies on inbound-initiated connections while inbound filtering is off, local relays, AF_PACKET and raw sockets, and code running as an allowed program's user, and the residual risks listed under The control socket and who can talk to it (code already running inside the official app or tray). A way around the firewall that this list does not describe, or a description that turns out to be wrong, is in scope.

What to expect:

• This is a single-maintainer hobby project; acknowledgement is best-effort, usually within a week.
• If the report is accepted, a fix will be worked on for the next release and you will be credited in the advisory unless you prefer otherwise.
• If it is declined, you will get a short explanation.

Dependency vulnerabilities are scanned continuously in CI with cargo deny (RustSec advisory database); a report is still welcome if you spot an exploitable path through a dependency before CI does.

Every release after 0.8.0 has each asset signed with the Project Colony organisation's ed25519 release key, in CI and never on a developer machine: each asset ships with a .sig, a .meta binding its name, sha256 and version, and a .meta.sig. The commands to check them are under Code signing policy. Releases up to 0.8.0 were not signed with that key.

The app binary and the tarball also carry a Sigstore-signed build provenance attestation, which ties their digest to this repository's release workflow and the tagged commit (tarballs since 0.8.0):

gh attestation verify colony-firewall-control-<V>-linux-x86_64.tar.zst \
    --repo Project-Colony/Colony-Firewall-Control

The attached PKGBUILD pins the hash of the source archive GitHub served when the tag was built; nothing compares that archive with the tagged tree, so it binds the recipe to those bytes and no further.